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DETAILED ACTION 

Response to Amendment 

1 . This communication is in response to the amendment filed on May 6, 2009. 
Claims 1-24, and 48 are canceled. 

Claims 25-47 are pending. 

Response to Arguments 

2. Applicant's arguments with respect to the 35 U.S.C. 1 01 rejections of claims 37- 
47 have been fully considered but are not persuasive. 

Independent claim 37 recites "a data processing system" comprising a user 
agent containing a plurality of means. Independent claim 44 recites a "content provider 
apparatus" comprising a plurality of means for providing a request resource. Applicant 
argues that the specification explicitly states " the user agent could be implemented in 
software, hardware or a combination thereof ([0021] of PG-Pub), and " the means of the 
content provider ... can be implemented in software, in hardware or as a combination of 
software and hardware " ([0094] of PG-Pub) thereby renders the claimed system and 
apparatus as statutory subject matters. 

The Examiner respectfully disagrees with the above remarks. Contrary to 
Applicant's interpretation, each of the system and apparatus defined by the citations 
above can indeed be implemented in software only (hardware or combination of 
hardware and software are not necessary or optional). Applicant is suggested to limit 
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the claimed subject matters of claims 37 and 44 to hardware or combination of 
hardware and software only (emphasis added) to overcome the above 35 U.S.C. 101 
rejections. 

Claims 38-43, and 45-47 are also rejected under 35 U.S.C. 101 based on their 
dependencies on claims 37 and 44 respectively. 

3. Applicant's arguments with respect to the 35 U.S.C. 103(a) rejections of the 
pending claims have been fully considered but are not persuasive. 

Applicant argues towards independent claims 25, 33, 37, and 44 regarding the 
fact that the combination of Cranor and Suryanaravana does not teach the cookie-policy 
receipt specifying whether a user associated with said user agent accepts or rejects the 
privacy policy. 

The Examiner respectfully disagrees with the above remarks. Accordingly, 
Suryanaravana explicitly discloses whether the response of a user accepting or 
rejecting the content provider's policy will activate retrieval of information from the 
content's provider or not (The user is now able to listen as well as read the policy and 
provide a response. The response may be, as indicated in the previous embodiments, a 
voice or text entry. If the user has responded that she agrees with the policy, the 
desired content from the Web site is retrieved with a command such as "HTTP Get 
coolpage. html" (711) , [0073]). Clearly, the response from the user is indeed the claimed 
policy receipt. 



Application/Control Number: 10/519,606 Page 4 

Art Unit: 2165 

In view of the above, the Examiner contends that all limitations as recited in the 
claims have been addressed in this instant Office action. Hence, Applicant's arguments 
do not distinguish over the claimed invention over the prior arts of record. 

For the above reasons, the Examiner believes that rejection of this instant Office 
action is proper. 

Claim Rejections - 35 USC § 101 

4. 35 U.S.C. 101 reads as follows: 

Whoever invents or discovers any new and useful process, machine, manufacture, or 
composition of matter, or any new and useful improvement thereof, may obtain a patent therefor, 
subject to the conditions and requirements of this title. 

5. Claims 37-47's rejections are maintained under 35 U.S.C. 101 because the 
claimed invention is directed to non-statutory subject matter. 

Regarding claim 37, "a data processing system..." is being recited with a user 
agent comprises multiple components, e.g. means for receiving, and means for 
transmitting. However, Applicant clearly states in the specification that "the user agent 
100 could be provided as software" ([Page 23, Lines 28-29]), thus confirms that the user 
agent and its components are indeed software components. 

Regarding claim 44, "a content provider apparatus adapted for..." is being 
recited with multiple components, e.g. means for receiving a resource request, means 
for transmitting a privacy policy, means for receiving a cookie-policy receipt, means for 
providing cookie. However, Applicant clearly states in the specification that "the means 
of the content provider 200 in Figure 6, i.e. I/O unit 210, cookie generator 230, and 
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database processor 240 can be implemented in software" ([Page 25, Lines 1 1 -1 4]), thus 
confirms that these components are indeed software components. 

Therefore, each of the claimed apparatus/system above is directed to a software 
system itself not a process occurring as a result of actually executing the software 
components, a machine programmed to operate in accordance with the software 
components, nor a manufacture structurally and functionally interconnected with the 
software components in a manner which enables the software components to carry out 
their functionalities. The claimed system/apparatus is also not a combination of 
chemical compounds to be a composition of matter. As such, it fails to fall within a 
statutory category. It is, at best, functional descriptive material perse. 

Claims 38-43, and 45-47 fail to resolve the deficiencies of claims 37, and 44 
since they only further limit the scope of claims 37, and 44 respectively. Hence, claims 
38-43, and 45-477 are also rejected under 35 U.S.C. 101 . 

The claims above lack the necessary physical articles or objects to constitute a 
machine or a manufacture within the meaning of 35 U.S.C. 1 01 . They are clearly not a 
series of steps or acts to be a process nor are they a combination of chemical 
compounds to be a composition of matter. As such, they fail to fall within a statutory 
category. They are, at best, functional descriptive material perse. 

Descriptive material can be characterized as either "functional descriptive 
material" or "nonfunctional descriptive material." Both types of "descriptive material" are 
nonstatutory when claimed as descriptive material perse, 33 F.3d at 1360, 31 USPQ2d 
at 1759. When functional descriptive material is recorded on some computer-readable 
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medium, it becomes structurally and functionally interrelated to the medium and will be 
statutory in most cases since use of technology permits the function of the descriptive 
material to be realized. Compare In re Lowry, 32 F.3d 1579, 1583-84, 32 USPQ2d 
1031, 1035 (Fed.Cir. 1994) 

Merely claiming non functional descriptive material, i.e., abstract ideas, stored on 
a computer-readable medium, in a computer, or on an electromagnetic carrier signal, 
does not make it statutory. See Diehr, 450 U.S. at 185-86, 209 USPQ at 8 (noting that 
the claims for an algorithm in Benson were unpatentable as abstract ideas because 
"[t]he sole practical application of the algorithm was in connection with the programming 
of a general purpose computer.") 



Claim Rejections - 35 USC § 103 

6. The following is a quotation of 35 U.S.C. 1 03(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set 
forth in section 102 of this title, if the differences between the subject matter sought to be patented and 
the prior art are such that the subject matter as a whole would have been obvious at the time the 
invention was made to a person having ordinary skill in the art to which said subject matter pertains. 
Patentability shall not be negatived by the manner in which the invention was made. 

7. Claims 25-30, 33-42, and 44-47 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over Cranor et al. (Platform for Privacy Preferences Syntax Specification, 
hereinafter Cranor ) in view of Survanaravana (Pub. No. US 2003/0112791, filed on 



December 14, 2001). 
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Regarding claim 25, Cranor clearly shows and discloses a method of managing 
cookies in a data processing system ([Pages 4-5, Section 1 .3]) comprising the steps of: 

a user agent requesting a resource associated with a cookie (proposal) from a 
content provider (home page ofCoolCatalog, [Page 45, Appendix 4]). 

receiving a privacy policy associated with said cookie; and {CoolCatalog sends a 
proposal, including privacy practices, disclosures, and the data elements to which they 
apply, [Page 45, Appendix 4]). 

said user agent transmitting, in response to reception of said privacy policy 
associated with said cookie (receipt of a proposal, [Page 16, Section 3.3.4, Paragraph 
1]), a cookie-policy receipt to said content provider, said cookie-policy receipt based 
only on a user decision (agreementID / fingerprint of agreement, [Page 5, Section 1 .3, 
Paragraph 4]). 

Cranor does not explicitly disclose cookie-policy receipt specifying whether a 
user associated with said user agent accepts or rejects the privacy policy. 

However, Survanaravana teaches cookie-policy receipt specifying whether a 
user associated with said user agent accepts or rejects the privacy policy (The user is 
now able to listen as well as read the policy and provide a response. The response may 
be, as indicated in the previous embodiments, a voice or text entry. If the user has 
responded that she agrees with the policy, the desired content from the Web site is 
retrieved with a command such as "HTTP Get coolpage.html" (7 11), [0073]. Clearly, the 
response from the user is indeed the claimed policy receipt). 
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It would have been obvious to an ordinary person in the art at the time of the 
invention was made to incorporate the teachings of Survanaravana with the teachings 
of Cranor for the purpose of allowing an individual to accept or reject that policy based 
on his or her own preferences about sharing personally identifiable information with the 
Web site after reviewing the privacy policy of a Web site owner ([0005] of 
Survanaravana ). 

Regarding claim 26, Cranor further discloses a method wherein user agent 
transmitting said cookie-policy receipt (agreementlD/fingerprint of agreement, [Page 5, 
Section 1.3, Paragraph 4] in a resource fetch message (OK in case of acceptance, 
[Page 14, Section 3.3.1] orSRYin case of refusal [Page 15, Section 3.3.3, Paragraph 
ID- 
Regarding claim 27, Cranor further discloses said user decision is determined 

by: 

said user agent comparing said privacy policy with user preference, said user 
preference specifying a cookie privacy policy accepted by said user {to determine 
whether to enter into an agreement. An agreement applies to all data exchanged 
between the user agent and service within a specified realm [Page 5, Section 1 .3, 
Paragraph 2]); and 

said user agent generating said cookie-policy receipt based on said comparison 
(agreementlD/fingerprint of agreement, [Page 5, Section 1.3, Paragraph 4]). 
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Regarding claim 28, Cranor further discloses a method wherein if said received 
privacy policy does not match said user preference ([Page 5, Section 1 .3, Paragraph 
4]), said method further comprising the steps of: 

said user agent presenting said received privacy policy for said user on said user 
equipment (shown to a human user); and 

said user agent generating said cookie-policy receipt in response to a user-input 
signal (agreementID / fingerprint of agreement). 

Regarding claim 29, Cranor further discloses wherein said user decision is 
determined by: 

said user agent presenting said received privacy policy for said user on said user 
equipment (shown to a human user); and 

said user agent generating said cookie-policy receipt in response to a user-input 
signal (agreementID / fingerprint of agreement) 

Regarding claim 30, Cranor further discloses the step of authenticating said 
cookie-policy receipt with an authentication key associated with said user agent (The 
MD5 algorithm is intended for digital signature applications, where a large file must be 
"compressed" in a secure manner before being encrypted with a private (secret) key 
under a public-key cryptosystem such as RSA or PGP, [Pages 41-44, Appendix 2]). 

Regarding claim 33, Cranor clearly shows and discloses a method of providing 
cookies in a data processing system where in a user agent requests a resource 
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associated with a cookie from a content provider ([Pages 4-5, Section 1 .3]), said 
method comprising the steps of: 

receiving a resource request, wherein the resource is associated with a cookie 
from said content provider ([Page 45, Appendix 4, Paragraph 2]), 

transmitting a privacy policy associated with said cookie to said user agent 
([Page 45, Appendix 4, Paragraph 4]); 

receiving a cookie-policy receipt based on a user decision from said user agent 
{CoolCatalog sends a proposal, including privacy practices, disclosures, and the data 
elements to which they apply, [Page 45, Appendix 4]); 

said content provider providing, in response to reception of a cookie-policy 
receipt from said user agent (user agent sending out requested data including 
agreementID it is operating under to server, [Page 16, Section 3.3.4, Paragraph 1]), 
said cookie to user equipment associated with said user agent when said cookie-policy 
receipt specifies that a user associated with said user agent accepts the privacy policy 
(once the user has accepted the agreement, the service will send the appropriate data 
elements, which are then saved transparently by the user agent, [Pages 10-11, Section 
2, Scenario 5]). 

Cranor does not explicitly disclose cookie-policy receipt specifying whether a 
user associated with said user agent accepts or rejects the privacy policy. 

However, Survanaravana teaches cookie-policy receipt specifying whether a 
user associated with said user agent accepts or rejects the privacy policy (The user is 
now able to listen as well as read the policy and provide a response. The response may 
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be, as indicated in the previous embodiments, a voice or text entry. If the user has 
responded that she agrees with the policy, the desired content from the Web site is 
retrieved with a command such as "HTTP Get coolpage.html" (7 11), [0073]. Clearly, the 
response from the user is indeed the claimed policy receipt). 

It would have been obvious to an ordinary person in the art at the time of the 
invention was made to incorporate the teachings of Survanaravana with the teachings 
of Cranor for the purpose of allowing an individual to accept or reject that policy based 
on his or her own preferences about sharing personally identifiable information with the 
Web site after reviewing the privacy policy of a Web site owner ([0005] of 
Survanaravana ). 

Regarding claim 34, Cranor further discloses a method wherein user agent 
transmitting said cookie-policy receipt in a resource fetch message {OK in case of 
acceptance, [Page 14, Section 3.3.1] orSRYin case of refusal [Page 16, Section 3.3.3, 
Paragraph 1]). 

Regarding claim 35, Cranor further discloses a method wherein, said cookie- 
policy receipt specifies that a user associated with said user agent accepts that said 
content provider provides said cookie to said user equipment (once the user has 
accepted the agreement, the service will send the appropriate data elements, which are 
then saved transparently by the user agent, [Pages 10-11, Section 2, Scenario 5]). 

Regarding claim 36, Cranor further discloses a method wherein cookie policy 
receipt is generated based on a comparison between said privacy policy and user 
preference ([Page 5, Section 1 .3, Paragraphs 3-4]) that specifies a cookie privacy policy 
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accepted by said user (An agreement applies to all data exchanged between the user 
agent and service within a specified realm [Page 5, Section 1 .3, Paragraph 2]). 

Regarding claim 37, Cranor clearly shows and discloses a data processing 
system for requesting a resource associated with a cookie (data) from a content 
provider ([Pages 4-5, Section 1 .3]), said data processing system comprising: 

a user agent ([Page 13, Section 3.2, Paragraph 1]), said user agent comprising: 
means for receiving a privacy policy associated with said cookie; ([Page 13, 
Section 3.2]) and 

means for transmitting (communicating to the server using standard HTTP 
methods such as "GET" or "POST", [Page 13, Section 3.2, Paragraph 1]), in response 
to reception of a privacy policy associated with said cookie (receipt of a proposal, [Page 
16, Section 3.3.4, Paragraph 1]), a cookie-policy receipt (agreementlD/fingerprint of 
agreement, [Page 5, Section 1 .3, Paragraph 4]) to said content provide. 

Cranor does not explicitly disclose cookie-policy receipt specifying whether a 
user associated with said user agent accepts or rejects the privacy policy. 

However, Survanaravana teaches cookie-policy receipt specifying whether a 
user associated with said user agent accepts or rejects the privacy policy (The user is 
now able to listen as well as read the policy and provide a response. The response may 
be, as indicated in the previous embodiments, a voice or text entry. If the user has 
responded that she agrees with the policy, the desired content from the Web site is 
retrieved with a command such as "HTTP Get coolpage.html" (7 11), [0073]. Clearly, the 
response from the user is indeed the claimed policy receipt). 
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It would have been obvious to an ordinary person in the art at the time of the 
invention was made to incorporate the teachings of Survanaravana with the teachings 
of Cranor for the purpose of allowing an individual to accept or reject that policy based 
on his or her own preferences about sharing personally identifiable information with the 
Web site after reviewing the privacy policy of a Web site owner ([0005] of 
Survanaravana ). 

Regarding claim 38, Cranor further discloses that transmitting means {standard 
HTTP methods such as "GET" or "POST", [Page 13, Section 3.2, Paragraph 1]) from 
user agent to content provider includes said cookie-policy receipt in a resource fetch 
message (OK in case of acceptance, [Page 14, Section 3.3.1] orSRYin case of refusal 
[Page 15, Section 3.3.3, Paragraph 1]). 

Regarding claim 39, Cranor further discloses a data processing system 
according comprising means for determining the user decision, said means for 
determining further comprising: 

means for comparing said received privacy policy with user preference to 
determine whether to enter into an agreement (An agreement applies to all data 
exchanged between the user agent and service within a specified realm, [Page 5, 
Section 1.3, Paragraph 2]). 
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means for generating, connected to said comparing means, said cookie-policy 
receipt as a function of said comparing of said privacy policy with said user preference 
([Page 5, Section 1.3, Paragraphs 3-4]). 

Regarding claim 40, Cranor further discloses [Page 5, Section 1 .3, Paragraph 4] 
a means for presenting said received privacy policy (proposal) for said user on said user 
equipment (shown to a human user), said generating means being adapted for 
generating said cookie-policy receipt (agreementlD/fingerprint of agreement) in 
response to a user input signal. 

Regarding claim 41 , Cranor further discloses means for determining the user 
decision, said means for determining further comprising: 

means for presenting said received privacy policy for said user on said user 
equipment (shown to a human user, [Page 5, Section 1 .3, Paragraph 4]); and 

means for generating said cookie-policy receipt in response to a user input signal 
(agreementID /fingerprint of agreement, [Page 5, Section 1.3, Paragraph 4]). 

Regarding claim 42, Cranor further discloses a means to authenticate said 
cookie-policy receipt (agreementlD/fingerprint of agreement, [Page 5, Section 1 .3, 
Paragraph 4]) with an authentication key associated with said user agent (The MD5 
algorithm is intended for digital signature applications, where a large file must be 
"compressed" in a secure manner before being encrypted with a private (secret) key 
under a public-key cryptosystem such as RSA or PGP, [Page 41 , Appendix 2]). 
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Regarding claim 44, Cranor clearly shows and discloses a content provider 
apparatus arranged to provide a requested resource associated with a cookie to a user 
agent in a data processing system ([Pages 4-5, Section 1 .3]), said content provider 
comprising: 

means to receiving a resource request from said user agent ([Page 9, Section 2, 
Scenario 1, Protocol Scenario]); 

means for transmitting a privacy policy associated with said cookie to said user 
agent (content/proposal is sent to user agent in a header, HTML header, or as 
referenced by URL, [Page 9, Section 2, Scenario 1 , Protocol Scenario]); means for 
receiving a cookie-policy receipt based on a user decision [Page 9, Section 2, Scenario 
1, Protocol Scenario]; and 

means for providing, in response to reception of a cookie-policy receipt 
(agreementlD/fingerprint of agreement, [Page 5, Section 1 .3, Paragraph 4] from said 
user agent (user agent sending out requested data including agreementID it is operating 
under to server, [Page 16, Section 3.3.4, Paragraph 1], said cookie to said user 
equipment associated with said user agent when said cookie-policy receipt 
(agreementlD/fingerprint of agreement, [Page 5, Section 1 .3, Paragraph 4]) specifies 
that a use associated with said user agent accepts the privacy policy (once the user has 
accepted the agreement, the service will send the appropriate data elements, which are 
then saved transparently by the user agent, [Pages 10-11, Section 2, Scenario 5]). 
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Cranor does not explicitly disclose cookie-policy receipt specifying whether a 
user associated with said user agent accepts or rejects the privacy policy. 

However, Survanaravana teaches cookie-policy receipt specifying whether a 
user associated with said user agent accepts or rejects the privacy policy {The user is 
now able to listen as well as read the policy and provide a response. The response may 
be, as indicated in the previous embodiments, a voice or text entry. If the user has 
responded that she agrees with the policy, the desired content from the Web site is 
retrieved with a command such as "HTTP Get coolpage.html" (7 11), [0073]. Clearly, the 
response from the user is indeed the claimed policy receipt). 

It would have been obvious to an ordinary person in the art at the time of the 
invention was made to incorporate the teachings of Survanaravana with the teachings 
of Cranor for the purpose of allowing an individual to accept or reject that policy based 
on his or her own preferences about sharing personally identifiable information with the 
Web site after reviewing the privacy policy of a Web site owner ([0005] of 
Survanaravana ). 

Regarding claim 45, Cranor further discloses that a content provider apparatus 
receiving said cookie-policy receipt (agreementlD/fingerprint of agreement, [Page 5, 
Section 1.3, Paragraph 4] in a resource fetch message (OK in case of acceptance, 
[Page 14, Section 3.3.1] orSRY in case of refusal [Page 15, Section 3.3.3, Paragraph 
ID- 
Regarding claim 46, Cranor further discloses means for providing said cookie- 
associated resource (content/proposal is sent to user agent in a header, HTML header, 
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or as referenced by URL, [Page 9, Section 2, Scenario 1, Protocol Scenario]) if said 
cookie-policy receipt specifies that said user accepts that said content provider provides 
said cookie to said user equipment (once the user has accepted the agreement, the 
service will send the appropriate data elements, which are then saved transparently by 
the user agent, [Pages 10-11, Section 2, Scenario 5]). 

Regarding claim 47, Cranor further discloses a content provider apparatus 
wherein cookie policy receipt (agreementID / fingerprint of agreement, [Page 5, Section 
1 .3, Paragraph 4]) is generated based on a comparison between said received privacy 
policy and user preference ([Page 5, Section 1 .3, Paragraphs 3-4]) that specifies a 
cookie privacy policy accepted by said user (An agreement applies to all data 
exchanged between the user agent and service within a specified realm [Page 5, 
Section 1.3, Paragraph 2]). 

8. Claims 31-32, and 43 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over Cranor et al. (Platform for Privacy Preferences Syntax Specification, 
hereinafter Cranor ) in view of Survanaravana (Pub. No. US 2003/0112791, filed on 
December 14, 2001), and further in view of Mitchell et al. (Pat. No. US 6,959,420, filed 
on November 30, 2001; hereinafter Mitchell ). 
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Regarding claim 31, Cranor , as modified by Suryanarayana , does not 
specifically disclose the step of removing previously stored cookie(s) associated with 
requested resource in user equipment. 

However, Mitchell discloses a method to evaluate web site platform for privacy 
preferences policy wherein operation for web site to persist, retrieve (referred to as 
replay) or delete its cookie data in the set of cookies on the user's machine being done 
through user input via a prompt ((Column 7, Line 56 -> Column 8, Line 28]). 

It would have been obvious to a person with ordinary skills in the art at the time 
the invention was made to incorporate the teachings of Mitchell with the teachings of 
Cranor , as modified by Suryanarayana , for the purpose of evaluating privacy policies 
provided by web sites to determine whether each side is permitted to perform 
operations (e.g., store, retrieve or delete) directed to cookies on a user's computer by 
comparing the privacy policy specified by the web site to the user's privacy preferences 
and other specified information available on the client computer ([Column 2, Lines 34- 
431 of Mitchell ). 

Regarding claim 32, Mitchell further discloses ignoring a cookie request 
command transmitted from said content provider to said user agent if said cookie-policy 
receipt specifies that said user does not accept that said content provider provides said 
cookie to said user equipment (evaluating web site platform for privacy preferences 
policy wherein user's response to the prompt may be stored in association with a 
particular web site so that the user needs not again to be interrupted when this site is 
accessed, [Column 12, Lines 39-53]). 
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Regarding claim 43, Mitchell further discloses removing a cookie associated with 
said requested resource from a storage in said user equipment if said cookie-policy 
receipt specifies that said user does not accept that said content provider provides said 
cookie to said user equipment (evaluation of web site platform with user's privacy 
preferences policy wherein there is a means for user agent to delete its cookie data in 
the set of cookies on the user's machine being done through user input via a prompt, 
[Column 7, Line 56 -> Column 8, Line 28]). 

Conclusion 

9. THIS ACTION IS MADE FINAL. Applicant is reminded of the extension of time 
policy as set forth in 37 CFR 1.136(a). 

A shortened statutory period for reply to this final action is set to expire THREE 
MONTHS from the mailing date of this action. In the event a first reply is filed within 
TWO MONTHS of the mailing date of this final action and the advisory action is not 
mailed until after the end of the THREE-MONTH shortened statutory period, then the 
shortened statutory period will expire on the date the advisory action is mailed, and any 
extension fee pursuant to 37 CFR 1 .136(a) will be calculated from the mailing date of 
the advisory action. In no event, however, will the statutory period for reply expire later 
than SIX MONTHS from the date of this final action. 
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